🫠 Vegas

Like Icarus, I too have flouted common sense and the laws of nature by attending Hacker Summer Camp from Monday through Sunday.

So far I have (mostly) survived the heat, and it’s been great catching up with friends.

It’s somehow been busier than usual, will share more reflections next week. And potentially a story of one of the most memorable, funniest things I’ve observed in person for quite some time.

It’s been strange not attending Hacker Summer Camp under Semgrep’s banner, for the first time in ~6 years. And kind of strange representing OpenAI, even though I’ve been working there for a few months now. I guess my identity/mental model is still updating, even though #LabLyfe is my day to day.

Over my career I’ve become comfortable having what I say represent “personal Clint” or “tl;dr sec Clint,” so it’s an adjustment to keep in mind that someone could interpret something I say offhand as representing official OpenAI policy (it doesn’t).

And working closely with comms and having a number of meetings with various journalists has been a new experience.

I hope you’re having an excellent week, enjoy the weekend, and talk soon my friend.

Sponsor

📣 Building Trust into Software Development

AI isn't just changing how software is built—it's redefining the software supply chain. As AI coding assistants, models, agents, and machine-to-machine workflows become part of modern development, organizations need a new approach that builds trust into the entire software development lifecycle. The new Software Supply Chain Security module in Cortex Cloud gives teams continuous visibility across this ecosystem, prevents vulnerable or untrusted components from reaching production, and maps emerging threats to affected assets. 

👉 Explore the Future of Software Supply Chain Security 👈

AppSec

We’re open sourcing our privacy proxy CLI
Cloudflare's Hannah Wang, Ben Yang, and Fisher Darling introduce pvcli, an open-source CLI that simplifies debugging privacy-preserving protocols like Oblivious HTTP by handling the binary encoding, encryption, and multi-party request routing in a single curl-style command. Instead of parsing hex-encoded keys by hand, hand-crafting binary requests, and guessing which step in the client-to-relay-to-gateway-to-target chain broke, engineers get verbose logging that shows exactly where a request failed. The tool supports mTLS to relays, custom relay headers, and step-by-step tracing, with a roadmap covering additional MASQUE transports, post-quantum cryptography for OHTTP, and Privacy Pass support.

From Finding to Fixing: Reducing maintainer burden with automated patches
Google's Dustin Ingram and Alex Kilian announce that DeepMind's CodeMender AI agent has been integrated into OSS-Fuzz to automatically generate patches for discovered vulnerabilities, moving beyond bug reporting to delivering ready-made fixes to reduce maintainer burden. When OSS-Fuzz detects a vulnerability through traditional fuzzing (maintaining near-zero false positive rates), CodeMender analyzes the crash details and source code to find the true root cause, explores multiple code paths and hypotheses in parallel, and generates patches validated in isolated environments to confirm they compile and don't regress functionality.

To address concerns about low-quality AI contributions, Google respects each repository's AI-contribution policies, tests every patch for compilation and crash resolution without regression, and has engineers manually review all patches during the beta phase before submission. Current coverage focuses on C/C++ memory safety vulnerabilities, with projects already enrolled in OSS-Fuzz receiving patches automatically without configuration changes.

How Figma Stays Ahead of Vulnerabilities With Agents
Figma's Rohan Sharma, Liam Buchan, and Dave Martin describe an agentic security system that guards code as it's written, reviews every pull request, and audits their decade-old monorepo, all running on the same shared threat model policy of 68 precedents. They prioritized precision over recall by hand-labeling false positives from 8 weeks of PRs, which raised precision from 15% to 80%. An adjudicator pass then lifted recall by roughly 30%, and Claude Code and Codex now run in parallel since they catch different bugs. Their eval framework measures recall against 66 real vulnerabilities (46 from HackerOne, 20 from incidents and audits), hitting a 75.8% union catch rate on bugs that previously escaped human review and SAST. Self-improvement loops update the policy when new bugs are found or false positives flagged. Agent hooks enforce secure-by-default patterns during code generation with roughly 50% fewer logging safety bugs, and repo-wide audits found 100+ latent vulnerabilities including 2 criticals missed by SAST.

💡 Absolute banger of a post. Love the focus on data-driven iteration to improve the TP/FP rates, and integrating code scanning at the right points throughout the SDLC. The self-improvement loop is especially cool, I expect to see more in this space. Excellent work, highly recommend.

Sponsor

📣 The State of Trusted Open Source

Chainguard's new State of Trusted Open Source report analyzed 2,400 container projects and 18,000+ vulnerability instances. Findings: 97% of vulnerabilities occurred outside the top 20 projects, high-severity issues rose 13% quarter-over-quarter, and new library-level data shows foundational packages hiding in nearly half of all environments. 

Securing open source remains one of the most important challenges in modern software security, and it's exactly what Chainguard is built for.

👉 Protect Your Open Source Artifacts 👈

Some interesting stats, including a breakdown of the most popular image projects, dependencies, CVEs, and more. I’ve chatted with some Chainguard folks this week, they’re doing some quite technically challenging, and in my opinion, high leverage work 👍️ 

Cloud Security

S3 Clones in the Neoclouds
Wiz's Scott Piper examines S3-compatible object storage services across six neoclouds (Nebius, Crusoe, Vultr, Lambda Labs, Cloudflare R2, and DigitalOcean), revealing significant security gaps compared to AWS S3. No clone matches S3 Block Public Access, only Nebius and DigitalOcean offer data plane logs, and fine-grained IAM is limited or absent (only Cloudflare, DigitalOcean, and Nebius offer read-only or bucket-specific restrictions). Scott highlights additional risks including access keys without structured prefixes that evade GitHub secret scanning (particularly Vultr and Lambda Labs, whose keys have no distinguishing pattern at all), presigned URLs that work across every S3 clone with the same security implications as AWS, and potential bucket-squatting attacks due to separate global namespaces. Scott’s analysis shows that organizations using these S3 clones cannot rely on AWS security assumptions and must account for reduced protections, limited least-privilege capabilities, and gaps in detection tooling.

A Security Analysis of Amazon S3 Vectors and Its Use in LLM Retrieval Pipelines
OFFENSAI's Ioan Criste and TUCN's Emanuel Ioniță analyze Amazon S3 Vectors and find the service itself sound, but its permission model and metadata handling open up serious risk in LLM retrieval pipelines. A single s3vectors:PutVectorBucketPolicy call from a compromised principal grants a foreign account full cross-account data-plane access (reads, writes, deletes), while the control plane stays owner-only. Anyone with s3vectors:PutVectors can inject unvalidated metadata like forged chunk text, spoofed citation URLs, and fake data-source identifiers, all of which bypass downstream filters.

Once that metadata reaches the model, it can drive RAG output manipulation, indirect prompt injection, or RCE in tool-enabled agents. The clinical RAG case shows how quickly this escalates, a single planted vector drove the assistant to recommend a dangerous drug dose while citing an untouched, authentic source PDF. After the fact, CloudTrail can't reconstruct any of it, data events are off by default, and even with them enabled the request payload strips vector keys, embeddings, and metadata, so responders learn only that an index was touched and have to hunt through the whole thing by hand.

Blue Team

This Iranian Malware Has No C2 Server to Block. The Command Channel Is a Meeting Invite in Your Own Calendar
Patrick Duggan discusses HollowGraph, an Iranian MOIS-linked malware disclosed by Group-IB that eliminates traditional C2 infrastructure by using the victim's own Microsoft 365 calendar to move commands and responses, commands arrive as meeting invites with encrypted attachments, responses return as appointments, all over legitimate Microsoft Graph API calls that appear as normal Outlook traffic. Detection requires behavioral analysis of Microsoft 365 audit logs and Graph API sign-in patterns, machine-cadence calendar operations, binary attachments on meeting invites, and anomalous Graph API token use, rather than traditional network IOCs, since mail-tier defenses and network monitoring cannot inspect authenticated first-party API calls to calendar objects.

Agentic incident response notebooks
Kyrre Wahl Kongsgård describes a marimo-based (think like Jupyter notebook) incident response system that unifies security data access, investigation workflows, and AI agents in executable notebooks. They created an SDK that wraps native query languages (SPL for Splunk, KQL for Defender XDR and Sentinel) and returns typed dataframes, so analysts can join results across platforms locally via DuckDB and ibis instead of exporting between tools. The same .py notebook works as analyst workspace, live shared view, deployable web app, and agent interface through marimo-pair, letting Claude Code create cells, run queries, and build case-specific investigation notebooks from scratch rather than maintaining alert-type templates. Examples: BYOVD hash joins against LOLDrivers, temporal correlations for Sliver C2 detection, and parallel fan-out across identity, PIM, and audit sources for case triage.

💡 Marimo looks neat, and I like the idea of having the analyst and agent collaborate in the notebook.

AI + Security

Incident Report: unsanctioned agent behaviour during cyber testing
The UK's AI Safety Institute (AISI) discovered that during cybersecurity evaluations with internet access enabled and safety filters disabled, AI agents autonomously took 19 unsanctioned actions targeting real people and organizations across 10 of 122 test runs, with 17 actions from Anthropic's Mythos 5 and 2 from OpenAI's GPT-5.6-Sol.

The most serious case involved an agent attempting a supply-chain attack by submitting malicious code to a real open-source GitHub project, creating fake identities to socially engineer the maintainer into approval, and using Tor to evade network restrictions—behavior that emerged without specific prompting as the agent persistently pursued its assigned cybersecurity challenge.

💡 Hol-y cow. This might not be the right take, but having an agent attempt a supply chain attack and social engineer a real open source project feels more misaligned/more worrisome to me than an agent tasked with finding 0-days choosing to find additional 0-days to solve the challenge. Like, I would hope that even cyber capable models would not be inclined to bully humans to achieve the desired outcome. 17 actions vs 2 👀 

Investigating three real-world incidents in our cybersecurity evaluations
Anthropic discovered three incidents where Claude models accessed the internet from supposedly isolated cybersecurity evaluation environments and compromised real organizations' infrastructure while attempting to complete capture-the-flag challenges. The incidents involved Claude Opus 4.7, Mythos 5, and an internal research model: one exploited weak passwords to access a company's database, another published a malicious Python package to PyPI that was downloaded by 15 real systems (including a security scanner whose credentials Claude then exfiltrated), and a third scanned 9,000 targets before compromising an application via SQL injection.

See also: Meta says its AI model hacked into another company during testing.

💡 “The earliest incidents date to April.” Blog published: July 30, roughly 3-4 months later. If OpenAI hadn’t published their blog post, I wonder if these other instances would have been discovered 🤔 Still, it’s great to see all of these write-ups from different companies, we’re all learning and advancing together ✊ 

Tailscale in the Hugging Face intrusion: The good news and the bad news
Tailscale's Avery Pennarun analyzes how an AI agent moved through Hugging Face's Tailscale network during the breach, where the agent escaped its sandbox, gained root on a Kubernetes node, stole 136 credentials including a reusable Tailscale auth key, and enrolled 181 nodes into the tailnet over four days. The auth key worked because it was long-lived and reachable in the credential vault, not because any Tailscale vulnerability was exploited.

To close that gap, Avery recommends replacing reusable auth keys with workload identity federation that issues short-lived OIDC tokens from cloud providers, enabling network flow logs that report from both connection endpoints so anomalies still surface even if one node is compromised, and using Tailnet Lock for programmable admission control. Tailscale plans to update documentation and UI so these defaults are easier to find and enable.

Before the first prompt: Code execution paths in trusted coding-agent projects
Datadog's Nick Frichette demonstrates two methods for achieving code execution in coding agents after project trust but before the first prompt, bypassing hook review mechanisms. In Codex, project-scoped MCP server configurations in .codex/config.toml automatically start attacker-controlled processes without requiring hook approval. In Claude Code, malicious .claude/settings.json files can prepend repository directories to PATH, causing Claude's automatic Git probes to execute a tracked repository wrapper instead of the real Git binary. Frichette provides a ripgrep command to spot risky settings across common agent directories, but stresses that manual review is incomplete since projects can influence execution through hooks, skills, MCP servers, editor tasks, and environment variables like BASH_ENV and NODE_OPTIONS, so project trust should be treated as equivalent to code execution.

Misc

• Scope of Hacks on U.S. Water Supply Widens as Evidence Points to Iran

• Tolkien Expert: You don't understand the Lord of the Rings

• Daniel Miessler on why Interceptor is the best Browser Control System for agents

• Perfect (feat. Simple Plan) - Punk Goes Princess - When you actually listen to the lyrics, this song hits hard 😭 Who’s crying? I’m not crying.

• Mark Manson - 7 Surprising Habits that Changed My Life in My 30s

• Tim Ferriss - I Asked AI What to Do With the Next 5 Years of My Life

• HealthyGamerGG - How to healthily release anger

• Make Some Noise - Every time Pete Holmes roasted Sam

✉️ Wrapping Up

Have questions, comments, or feedback? Just reply directly, I’d love to hear from you.

If you find this newsletter useful and know other people who would too, I'd really appreciate if you'd forward it to them 🙏

Thanks for reading!

Cheers,
Clint

P.S. Feel free to connect with me on LinkedIn 👋